Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2018-19115

32
FAUCET Score

CVE-2018-19115 is a critical heap-based buffer overflow vulnerability affecting Keepalived versions prior to 2.0.7, as well as Debian and Red Hat distributions. This flaw, stemming from improper HTTP status code validation, allows an unauthenticated attacker to trigger a denial-of-service or potentially achieve arbitrary code execution. With a CVSS score of 9.8 (CRITICAL), it presents a significant risk due to its network-based attack vector and low attack complexity. Despite its high severity, there is currently no evidence of active exploitation, nor are public exploits available in common repositories like Metasploit or ExploitDB, and it has received minimal community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
< 2.0.7CPE matchmatch criteria
cpe:2.3:a:keepalived:keepalived:*:*:*:*:*:*:*:*
8.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
7.0CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux_server:7.0:*:*:*:*:*:*:*
7.6CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux_server_aus:7.6:*:*:*:*:*:*:*
7.6CPE matchmatch criteria
cpe:2.3:o:redhat:enterprise_linux_server_eus:7.6:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.0

9.8CRITICAL

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
5.9
CvssVersion
3.0

Exploit Intelligence

EPSS Score
3.75%
Probability of exploitation in next 30 days
EPSS Percentile
88.7%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0375 is in the 81st percentile among its peer group of 36,833 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (5)

github_advisorypatch availablevia nvd_reference
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7Fixed in: keepalived-0:1.3.5-8.el7_6
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.4 Extended Update SupportFixed in: keepalived-0:1.3.5-1.el7_4.1
View patch
redhatpatch availablevia redhat_api
Product: Red Hat Enterprise Linux 7.5 Extended Update SupportFixed in: keepalived-0:1.3.5-7.el7_5.2
View patch
redhatend of lifevia redhat_api
Product: Red Hat Enterprise Linux 6Fixed in: keepalived

Vendor Advisories (1)

redhatCVE-2018-19115Important

keepalived: Heap-based buffer overflow when parsing HTTP status codes allows for denial of service or possibly arbitrary code execution

Nov 8, 2018

References

access.redhat.com / errata/RHSA-2019:0022
Third Party Advisory
access.redhat.com / errata/RHSA-2019:1792
access.redhat.com / errata/RHSA-2019:1945
bugzilla.suse.com / show_bug.cgi
Issue TrackingThird Party Advisory
github.com / acassen/keepalived/pull/961
PatchThird Party Advisory
github.com / acassen/keepalived/pull/961/commits/f28015671a4b04785859d1b4b1327b367b6a10e9
PatchThird Party Advisory
lists.debian.org / debian-lts-announce/2018/11/msg00034.html
Mailing ListThird Party Advisory
security.gentoo.org / glsa/201903-01
Third Party Advisory
usn.ubuntu.com / 3995-1
usn.ubuntu.com / 3995-2